In message <e54865560906260903n5861f5d4j5b72e035a877e...@mail.gmail.com>,
Clayton Dukes writes:
>That seems to have made it worse...what am I doing wrong?
I was apparently using too much shorthand.
>On Fri, Jun 26, 2009 at 10:38 AM, John P. Rouillard<rou...@cs.umb.edu> wrote
>:
>>
>> In message <e54865560906260700g1d87f860l199f8785efe5f...@mail.gmail.com>,
>> Clayton Dukes writes:
>>>I'm wondering if it's normal for sec to spawn multiple processes for
>>>every incoming message?
>>> [...]
>>>And my test config for sec:
>>>#################################################
>>># %CCM_CALLMANAGER-CALLMANAGER
>>>type=Single
>>>ptype=RegExp
>>>pattern=(.*CCM_CALLMANAGER-CALLMANAGER.*)
>>>desc=CallManager
>>>action=pipe '$1' /www/svn/php-syslog-ng/scripts/sec_db_dedup.pl
>>>
>>>
>>>The sec_db_dedup.pl script is doing database inserts and exiting.
>>>When I run syslog-ng, I get 30-40 processes for sec_db_dedup.pl and
>>>another 30-40 processes for sec
>>>Is this normal behavior?
>>
>> Yes. pipe is the same as shellcmd, except it sends data on stdin. What
>> you may want is the opposite of a spawn command: i.e. a persistant
>> process that sec can write to (spawn provides a persistant process
>> that sec can read from).
>>
>> When I did this, I used (the equivalent of):
>>
>> shellcmd 'tail -F /tmp/file | command'
>>
>> that fired when sec started up (see -intevents in the man page).
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
This is what you missed. You only run the tail pipeline once on
startup of SEC.
So something like:
type = single
ptype = ...
pattern = true
context = SEC_STARTUP
action = shellcmd tail -F /tmp/sec.log | \
/www/svn/php-syslog-ng/scripts/sec_db_insert.pl
>Here's what I have:
>#################################################
># %CCM_CALLMANAGER-CALLMANAGER
>type=Single
>ptype=RegExp
>pattern=(.*CCM_CALLMANAGER-CALLMANAGER.*)
>desc=CallManager
>action=write /tmp/sec.log $1
>action=shellcmd tail -F /tmp/sec.log |
>/www/svn/php-syslog-ng/scripts/sec_db_insert.pl
Hmm, that should throw an error I think. Two action statements aren't
valid AFAIK. Risto?
>> This initial shellcmd is responsible for making sure that 'command'
>> exists/restarts if it crashes etc... Once you have that set up, send
>> data to it using:
>>
>> write /tmp/file .....
>>
>> in place of the pipe command.
So you should have:
#################################################
# %CCM_CALLMANAGER-CALLMANAGER
type=Single
ptype=RegExp
pattern=(.*CCM_CALLMANAGER-CALLMANAGER.*)
desc=CallManager
action=write /tmp/sec.log $1
to write the CALLMANAGER event to the pipe.
I am not sure if the pattern is really what you are using, but it will
be faster if you chnage tha pattern to remove the ()'s and change it to
pattern = CCM_CALLMANAGER-CALLMANAGER
Then in the action use:
action=write /tmp/sec.log $0
The pattern you have expensively matches the entire line which is what
is returned by $0.
If you search the mailing list for SEC_STARTUP I think there are a
couple of examples of it's use.
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
